Apache httpd 2.4.26 released

http://www.apache.org/dist/httpd/Announcement2.4.html

by jimjag • 9 years ago

77 52 9 years ago

d4ed0a4• 9 years ago

Wait, Apache is still around? I mean, with nginx being the state-of-the-art industry standard http server, why even keep around a forking server?

Thaxll• 9 years ago

It has been a while since Apache "scales"

https://httpd.apache.org/docs/2.4/mod/event.html

breser5• 9 years ago

Full disclosure: I'm a committer on the Apache httpd server.

I hope this is sarcasm. Apache has support for the same event driven model that NGINX has. Since most people get their copy of Apache from their distribution they're often getting a rather old version of Apache. NGINX has taken good advantage of this to imply that Apache is out of date.

I happen to also use NGINX at work. What I'll say is it has it's own set of problems. There are various reasons to choose one or the other for a particular problem. But the idea that Apache httpd is obsolete is nonsense.

pram• 9 years ago

To be fair most distros (still?) provided Apache with mpm_prefork as the default. I doubt many people even realize you can use an event based handler. Out of the box nginx will be way more performant.

tannhaeuser2• 9 years ago

Congrats to the release (I'm a lurker on httpd-dev so I know that http2/mod_h2 is out of the "experimental" state).

There are various reasons to choose one over the other

Care to elaborate? Out of my head I could think about these:

- rfc caching with proper revalidation (as opposed to mere Expires: header generation)

- process isolation (aka CGI)

- better docs (and community/mindshare, though unsure about the latter)

- vhosting ecosystem

kijin• 9 years ago

Apache has support for the same event driven model that NGINX has. Since most people get their copy of Apache from their distribution they're often getting a rather old version of Apache.

I don't think that's fair to Linux distros, either. Most popular distros have been shipping mpm_event for quite a few years, even if not enabled by default (because of mod_php).

I understand that as a developer of a phenomenal piece of software, you would prefer everyone to use the latest and greatest version. But for a typical user, Apache is so stable that the difference between CentOS's 2.4.6, Ubuntu's 2.4.18, and the latest version doesn't look large enough to have a significant effect in an "Apache vs. nginx" debate. After all, distros ship outdated versions of everything, including nginx.

sdeziel• 9 years ago

Apache httpd also supports some features that are not available with NGINX. (Easy) LDAP authentication is one of those.

davidgerard5• 9 years ago

Apache's collection of bundled modules is amazing (and as varied as you'd expect of software two decades old), and only switched on when you switch them on.

alberts00• 9 years ago

Mind explaining this further?

I am currently running an Nginx server which is using PAM service, which in turn is configured to authenticate against LDAP via pam_sss. I don't really see the use case having Nginx authenticating directly to LDAP.

okket• 9 years ago

Changelog: https://www.apachelounge.com/Changelog-2.4.html

alberth• 9 years ago

What's the pro / con of using Apache vs Nginx these days?

davidgerard5• 9 years ago

Neutral:

* You are probably not Google and the http/https server is almost certainly not a performance problem worth worrying about.

Pro-Apache:

* Swiss army knife. At my day job we use a pile of Apache modules; if we went nginx we'd have to replace these with a kitchen drawer full of standalone gadgets.

* You know Apache well.

* Lots of LAMP apps pretty much presume Apache (WordPress plugins in particular) and nginx support is a me-too.

Pro-nginx:

* Smaller and cleaner config.

* You know nginx well.

* nginx support is getting better, if you like nginx it's worth checking your prospective application.

Honestly, for almost all use cases it probably doesn't matter which. Pick whatever makes you most effective.

cookiecaper• 9 years ago

One point against nginx: it's an "open core" product. The free/OSS version lacks features so that Nginx Inc. can sell them to companies.

tbrock• 9 years ago

Well, the best pitch I've heard for nginx is:

"Come for the performance, stay for the configuration".

astrodust• 9 years ago

The Nginx configuration format is a lot more coherent than the Apache httpd equivalent.

user5994461• 9 years ago

It's 99% of the same. Green apple and red apple.

If you have an existing configuration written in any, it invariably ended up as a pile of hacks, domains and misredirections that is a pain to rewrite for the other. That makes it hard to change.

Apache has support for some modules, mostly for authentication, that nginx doesn't have.

Old applications, like wordpress, are only supported and documented on Apache.

dullgiulio• 9 years ago

Old applications, like wordpress, are only supported and documented on Apache.

Wordpress is not old, it is just very badly written.

aduth• 9 years ago

Old applications, like wordpress, are only supported and documented on Apache.

Not true: https://codex.wordpress.org/Nginx

davidgerard5• 9 years ago

Old applications, like wordpress, are only supported and documented on Apache.

WordPress itself is fine. Many plugins, however, assume Apache (and MySQL).

jeltz2• 9 years ago

I find nginx easier to use and their documentation better. On the other hand Apache has some features which are missing from nginx like supporting client certificate authentication only on a specific path. Either will probably solve your use case just fine.

combatentropy2• 9 years ago

One of my favorite features of Apache is MultiViews. It lets me make a file like this:

    www.example.com/widgets.html

and this address without the file extension will work:

    www.example.com/widgets

If the file is widgets.php or some other language that Apache considers a script, then even this will work:

    www.example.com/widgets/1234

and $_SERVER['PATH_INFO'] will be set to /1234.

This is all turned on with one line in a configuration file:

    Options +MultiViews

instead of having to turn on mod_rewrite, with its complexity.

berns• 9 years ago

One difference that I think is important: no .htaccess in nginx. So the only way to change any configuration in nginx is in the configuration files and a server restart is necessary.

ag_47• 9 years ago

Note that this is intended and desirable for any server with moderate to high loads. Plus, Nginx can reload its configuration gracefully without dropping connections.

LinuxBender• 9 years ago

Apache is stable, rarely any security related issues; and even then, it's usually a module not installed/enabled by default.

Nginx and Apache are about the same performance, assuming you are on 2.4.x and using the latest apr/apr-util/apr-iconv. The memory footprint is about the same and benchmarks are about the same.

Nginx still hard codes libc options that I have to undo in the Makefile each time to get the glibc hardening options enabled. (PIE, Full RELRO, stack protector and so on) I have not tested the last 3 or so releases, so maybe Maxim has resolved this?

I prefer Apache for anything CGI related, as the security is more tightly coupled to the webserver. With NGINX, I have to use another daemon that has it's own security settings, environment, etc.

jimjag• 9 years ago

Some substantial changes, esp for those not familiar with httpd 2.4 and just know about 2.2 (or older!):

- Performant reverse proxy - RFC compliant caching with various backends, including Redis, memcached, etc... - Load balancing with fail-over - Dynamic proxy configuration - Dynamic reverse proxy health checks - FPM for PHP and others - Event-based, async request handling - HTTP/2 support - brotli support

See https://www.slideshare.net/jimjag/apachecon-2017-whats-new-i...

Freaky• 9 years ago

Finally:

*) HTTP/2 support no longer tagged as "experimental" but is instead considered fully production ready.

icholy• 9 years ago

mod_proxy_http2 is still experimental though :(

Apache httpd 2.4.26 released

Related Stories